Executive brief
The Linux kernel's Dreamcast VMU flash memory driver fails to properly initialize device parent relationships, causing the system to crash during startup. This is a local denial-of-service issue affecting systems with Dreamcast VMU flash devices attached; exploitation requires physical access or local code execution capability to trigger the initialization path.
Technical details
A NULL pointer dereference occurs in the vmu-flash MTD (Memory Technology Device) driver during initialization of Dreamcast VMU flash partitions. The vulnerability stems from the MTD device structure's parent device pointer not being set before device registration, which violates the kernel's device model requirements. The attack vector is local only—an attacker must either have physical access to attach a Dreamcast VMU device or be able to trigger the device initialization code path locally. The fix, committed upstream, adds a single line to set `mtd_cur->dev.parent = &mdev->dev` in the `vmu_queryblocks()` function, establishing the proper parent-child relationship in the device tree and preventing the crash.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (as per git stable branches affected)
Timeline
- 2026-08-28: disclosed
- 2026-05-27: patched: Fix committed upstream by Miquel Raynal